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Abstract 

In this paper, we describe a robust quantum cryptography scheme with a heralded single photon 
source based on the decoy-state method, which has been shown by numerical simulations to be 
advantageous compared with many other practical schemes not only with respect to the secure 
key generation rate but also to secure transmission distance. We have experimentally tested this 
scheme, and the results support the conclusions from numerical simulations well. Although there 
still exist many deficiencies in our present systems, it's still sufficient to demonstrate the advantages 
of the scheme. Besides, even when cost and technological feasibility are taken into account, our 
scheme is still quite promising in the implementation of tomorrow's quantum cryptography. 
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I. INTRODUCTION 



Cryptography plays an important role in the field of communication, the goal of it is 
to render messages between legitimate users (usually called Alice and Bob) but incompre- 
hensible to Eve (a malicious eavesdropper). However, classical cryptography is based on 
conjectured computational complexity, and its security is thus threatened by the advance- 
ment in mathematical algorithms and computational power. Compared with the classical 
method, quantum cryptography has unprecedented advantages because it does not based on 
computational complexity, and its unconditional security is ensured by the "battle tested" 
theory of quantum mechanics [1-5]. 

Since the first protocol of quantum cryptography was put forward by Bennett and Bras- 
sard in 1984 [1], (hereafter called BB84 protocol,) quantum cryptography has been widely 
investigated and developed by large numbers of researchers and scientists, not only in theory, 
but also by experimental implementations. Unfortunately, there always exists some discrep- 
ancies between the "in principle" unconditional security and realistic systems. Therefore, 
people have to take practical usability into account when estimating a quantum cryptosys- 
tem, just as summarized in Ref. [6]: 

Infinite security =>- Infinite cost 

=>- Zero practical interest. (1) 

In current practice, an attenuated laser (i.e., emitting a weak coherent state WCS) or a 
parametric down-conversion source (PDCS) are employed in most quantum cryptosystems. 
A WCS is quite easy to implement. However, it contains a large vacuum state probability 
amplitude and unneglectable multiphoton probability amplitude when attenuated to a single 
photon level, which is fatal to photon-number-splitting (PNS) attack [7-10] and some other 
attacks. To compensate the security, one has to attenuate a laser into a quite low inten- 
sity (e.g. 0.1 photon/ pulse), resulting in a low secure key generation rate and a limited 
transmission distance. 

Fortunately, the so-called decoy-state method was given out [11-13]. The main idea of 
the decoy-state method is to randomly mix extra decoy transmission events with the true 
signal transmission events. The decoy transmission events and the signal transmission events 
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have the same characteristics (such as wavelength, bandwidth and timing information, etc.) 
except for different intensities. Therefore, for a given random photon state, Eve is unable to 
judge whether it comes from a decoy transmission event or from a signal transmission event. 
Hence she has to perform the same operations on them. On the other hand, the legitimate 
users, Alice and Bob, could estimate the behavior of vacuum, single-photon and multi-photon 
states individually just by doing some counting measurements and classical communications. 
As a result, Eve's eavesdropping with be detected. It has been shown that the decoy- 
state method has significantly improved the performance of a quantum cryptography with 
practical systems. 

The heralded single-photon source (HSPS) from parametric down-converted (PDC) pro- 
cesses has also been widely investigated in recent years [14-18]. Its sub-Poissonian photon 
number distribution makes it suitable for the implementation of quantum cryptography. (It 
has already been proven that a sub-Poissonian distributed source is superior to a Poissonian 
one in the quantum cryptography [19].) 

Combining the advantages of the decoy state method and the HSPS, we have proposed 
some schemes that applies both of them in a quantum cryptography setup [20-23]. In 
Ref. [20-22], only theoretical aspects are discussed (for simplicity, those models in them all 
assumed some ideal conditions, i.e. the idler and the signal photons in different paths have 
the same photon distributions before being detected. However, they can be quite different 
in practice because of existing coupling loss and some other factors.). In Ref. [23], some 
preliminary experimental results are presented. Here in this paper, we will describe our 
theory and experiment in detail and include some experimental improvements as well. 

This paper is organized as follows: At first, in section II, we will introduce some basic 
theory on HSPS and report some experimental results from our group; In section III, we 
will introduce our scheme in detail, and also do some numerical simulations to show the 
advantages of our scheme compared with other practical schemes; In section IV, we will 
describe our experimental setup and experimental processes, and compare our experimental 
results with theoretical predictions; Subsequently, we will discuss some deficiencies existing 
in our present systems, and then make suggestions on how to improve them in section V; 
Finally, the conclusions are drawn and the future prospects are spelled out. 
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II. THEORY AND EXPERIMENT IN HSPS 



In recent years, a HSPS based on a PDC process has been investigated by many groups. 
With improvements of down conversion in waveguides and four-wave mixing, a lot of en- 
couraging results have been reported [14-18] . 

The main idea of the HSPS is to use one photon (heralding) of a photon pair to announce 
the arrival of the other one (heralded). The temporal statistics of a HSPS can be controlled 
by utilizing a prior information (i.e., original distribution) extracted from the photon pairs. 
As said in Ref. [14], during the nondegenarate spontaneous parametric down conversion 
(SPDC) process, if a pulsed pump laser is used, as long as the coherence time of the emission, 
At c , is much longer than the duration of the pump pulse, At, i.e., At c ^> At, (in practice 
easily obtained by using ultrafast (fs) pulse pump lasers), a single emission process will 
take place, giving an thermal photon number distribution. In contrast, when a continuous 
wave (CW) laser is used, as long as At c is much shorter than the gating period of the 
detector, a large number of independent SPDC processes will be present, each thermally 
distributed, but collectively resulting in a Poisson distribution. However, the "original" 
distribution can be altered by conditional gating. By choosing proper gating time and using 
an appropriate correlation rate, a sub-Poissonian distributed HSPS can be obtained as the 
result of postselections. 

To quantify our source, let us introduce the second-order auto-correlation function at 
zero-time delay: 

gi 2 ){0) = 2^2. (2) 
m>l 

(It is known that, the value of <^ 2 )(0) could be used to classify a source between a Poisson 
(g<®(0) = 1), a sub-Poisson (# (2) (0) < 1) and a super-Poisson (g^(0) > 1) distribution.) 
P m >k is the probability to find at least k photons within a gating period, which can be 
expressed as: 

Prn>k = P C ° r PZ_ k -l + (1 " P CO lPZ k , (3) 

where P cor is the correlation rate of photon pairs, i.e. the probability that we can predict the 
existence of a heralded photon when a heralding one was detected. (Its value equals unity 
under perfect experimental conditions, i.e., when there is no coupling loss, no transmission 
loss, and no detection loss etc.) P%£ k is the probability that at least k accidental photons 
are present within a gating period, which comes from the "original" statistical distribution 
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of the down-converted light (the coherence time of the single photons (At c ~ 10 ps) is much 
less than the integration time (2.5 ns), as a result, those signal photons which are not coming 
from the same SPDC process as the heralding one (it means they are not truly correlated 
photon pairs) may also contribute to the final coincidence counts.). It is given by: 

fc-i j 

PSgk = 1 - E| e ^' ( k * 2) (4) 

i=0 

where fi is the average photon number per gating time (before detection), \x = R s ■ Atg ate , 
R s is the mean photon number per second (before detection), and At gate is the gating time 
of the detector. 

Moreover, the probability of getting exactly n photons within the gating time is: 

P{n) = P m > n - P m > n+1 , (ra>2). (5) 

To be noted, the vacuum state probability should be treated independently, which can 
be stated as: 

P(0) = P cor ■ di + (1 - P cor ) ■ e"", (6) 

where di is the dark count probability of the detector for heralding photons. 
Consequently, the single-photon probability is: 

P(l) = 1 - P(0) - P m > 2 . (7) 

Considering Eqs. (2)-(7), in order to analyze a HSPS, we should at first get to know the 
values of P cor and //. In the following, we will explain how their values can be determined 
in an experiment. 

Our experimental setup for the HSPS is shown in Fig. 1. We use a CW laser at the 
wavelength of 532 nm to pump a periodically-poled LiNb0 3 (PPLN) crystal of 50 mm 
length to generate non-degenerate correlated photon pairs. The photon at the wavelength 
of 809 nm is called idler, and the one at the wavelength of 1555 nm is called signal. After 
separation by a dichroic mirror (DM), they are coupled into different detectors. For the idler 
photons, we used a Si-based APD (PerkinElmer SPCM-AQR-14) with a detection efficiency 
of about 50%; for the signal photons, a InGaAs-APD (id200-SMF) operating in gated Geiger 
mode is used. Whenever there is an idler photon being detected, an electronical pulse is sent 
out. After the time chopper (TC, the details about it will be described in section IV), each 
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Fig. 1: (Color online) Schematics of the experimental setup to produce a HSPS. PPLN: 
periodically-poled LiNb03 crystal; DM: dichroic mirror; F: filter; L: lens; TC: time chopper; CP: 

counter processing; Ri and R s are the photon rates inside the fibers for idler and signal 
respectively; rj is the single photon counting rate at the Si-detector; Rq is the triggering rate; r c 
and r s are the counting rates at the InGaAs detector triggered by idler photons and triggered by 

random pulses individually. 

electronical pulse is used to trigger the InGaAs detector (with a gating time of 2.5 ns), then 
the coincidence count, r c , will be obtained; r { is the Si-detector single counting rate; r s is 
the InGaAs detector single counting rate with random gating (the gating frequency is Rq), 
to provide the mean accidental photon number; Rq is the heralding rate, whose value can 
be different from ri, because of the dead/delay time of the pulse generator used; Besides, 
rji (r] s ) and di (d s ) are the detection efficiency and dark count probability of idler (signal) 
photons respectively; Ri (R s ) is the corresponding photon number for idler (signal) before 
detection. 

When the InGaAs detector is randomly gated, the detection probability can be written 

as: 

P£T = = 1 - (1 - PaCC )( l - P^rk), (8) 

Kq 

where P acc (= 1 — e~ VaRsAtBate ) and Pdark (= jt) are the corresponding probabilities caused 
by accidental photons and dark counts. 
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Table I. The measured photon-number distributions of our HSPS under different triggering 



frequencies. 



Trigger frequency 
(after time 
chopper, kHz) 


Mean photon 
number (per 
gate, 2.5ns) 


Po 


Pi 


P2 


s 2 (0) 


pcor 


200 


0.577x10 3 


0.566884 


0.432830 


2.85710x10" 


3.046x10 3 


0.432837 


650 


5.325xl0- 3 


0.591017 


0.406811 


2.17189xl0- 3 


2.597xl0- 2 


0.405844 



From these relations, it can be deduced that: 

». = -£- 0) 

r} s Atg a te Ro - r s 

When the InGaAs detector is gated by idler photons, the detection probability is: 

Pdet = £ = 1 - (1 - P C ° r )(l ~ P aCC )^ ~ Pdark), (10) 
Ho 

because the detection events can be caused by correlated photons, accidental photons or 
dark counts. The equations above lead to: 

R — r 

pcor _ y _ c c risRsAt gat e 

Rq — d s 

Obviously, all the parameters in Eqs. (9) and (11) can be experimentally measured, 
giving the values of R s and p cor . By substituting them into Eqs. (2)-(7), we can finally 
calculate the photon number distribution of our source shown in Table I. 

It can be seen from Table I that, because of a CW laser being used, the multi-photon 
probability of our source has substantially been depressed. By carefully optimizing the 
alignment of our optical systems, we can get a sub-Poissonain distributed HSPS with the 
single photon probability of about 40% (it's about 30% in [23]), which substantially improves 
the performance of a quantum cryptography as shown in Fig. 2. 



III. QUANTUM CRYPTOGRAPHY WITH A HSPS BASED DECOY-STATE 
METHOD 

Similarly to Ref. [20-22], we have used a three-intensity (//, yU, /i ) decoy-state method, 
where //, ji and fi are the mean photon number per gate for the signal light, the decoy light 



7 



and the "vacuum" light individually. The counting probabilities for // and /x can be written 

as: 

oo 

=YY n PAn\ (12) 

i=0 

oo 

Q M = J>„P», (13) 

i=0 

Defining Y n to be the yield of an n-photon state, i.e., the conditional probability of a 
detection event at Bob's side given that Alice sends out an n-photon state, which is essentially 
a sum of two contributions, background and true signal, i.e., Y n = Y + 1 — (1 — rj) n . r\ is 
the combined detection efficiency and transmittance between Alice and Bob. Y is Bob's 
background rate, which includes the detector dark count and other background contributions 
such as the stray light from timing pulses. The gain, G n is the product of the probability 
of Alice sending out an n-photon state and the conditional probability of Alice's n-photon 
state, which is given by: G n = Y n P{n). P^iji) (P /1 (n)) is the n-photon number probability 
in the source of // (n). 

Furthermore, the average quantum bit error ratios (QBER) for // and fi are given by: 

oo 

^Y n P^{n)e n 

E»> = ^—^ , (14) 



n e. 



E, = ^—^ , (15) 

where e n is the quantum bit error probability of an n-photon state. 
Eq. (12) and (13) lead to: 

= Y [P„(2)PM ~ /M2)P„(0)] + Y 1 [P,,(2)P,(1) - P,(2)P,,(1)] 

oo 

+ Y/APAVPM - P,(2)PAn)}. (16) 

i=2 

Considering Eqs. (2)-(7) and the values of P cor for ji and fj,' in Table I, one can show that 
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for our setup ^Y n (P^(2)P M (n) - P M (2)P M ,(n)) < 0, which leads to: 



i=2 



Yi > P„(2)Q„ - P M (2)Q M , - Fo(Pm'(2)P m (0) - P M (2)^(0)) 



ei < 



(P,,(2)P,(1)-P,(2)P,,(1)) 

P M 'Q M ' -e r p^(o) 



When taking statistical fluctuations into account, we can get a lower bound for Y 1 and an 
upper bound for e\. 

PsWQj - PyWQZ - ^(p^(2)p m (Q) - p„(2)p„(o)) 



(P^(2)P M (1)-P M (2)P M ,(1)) 

[/ _p^- eo y L P^(o) 



(18) 



where gj . g M (i - , gg . q ^ 1 + 7 m=^ Q, E u s 

^ (l + T^fe) • # - (l - , and Y* - (l + ^) [24]. 



After error correction and privacy amplification, we can get the final key generation rate 
from the signal (//) [25, 26]: 

R > q{-Qsf (E^) H 2 (Py) + G + G{ [1 - Pf 2 (ef )] } , (19) 

where the factor q (= |) comes from the cost of basis mismatch in the Bennett-Brassard 1984 
(BB84) protocol, (it's \ when a one-detector scheme is used), /(Py) is a factor represents 
the cost of error correction given existing error correction systems in practice. We use 
/(Py) = 1.22 here [8]; In addition, G = Y o P^(0); G\ = Y^P^^l); H 2 (x) is the binary 
Shannon information function, given by 

H 2 (x) = -x\og 2 (x) - (1 - x) log 2 (l - x). 

We have used decoy states in the above deduction processes for G\ and ef . However, we 
will consider the case without decoy states in the following, in order to make a comparison. 
Without decoy state, we have to do a pessimistic assumption in the estimation of G\ and 
ef , i.e., we have to assume that the photons that fail to arrive at Bob's side all come from 
single photon states. As a result, we get the lower bound of G\ as: 

oo 

G\ = Q^-G -J2 p An)- (20) 

i=2 



It's the same as Eq. (18), corresponding upper bound value of t\ can also be obtained. 

Using the formulas above and considering different distributions, we can give a comparison 
between our scheme using a HSPS based decoy-state method and other practical schemes, 
including using a HSPS but without decoy-state method, WCS with (or without) decoy-state 
method, and an ideal single photon source. For the sake of fairness, during the comparison 
in all the schemes, we use the BB84 protocol and assume the same experimental conditions, 
i.e., the same dark count probability 0.8 x 10~ 5 /gate, the same detection efficiency 7.5%, and 
the same misalignment of the system elector ~ 2.5%. Corresponding numerical simulation 
results are shown in Fig. 2. Clearly, compared with other practical schemes, our scheme 
can tolerate the highest total loss, that also means the highest key generation rate under 
fixed loss. Moreover, if a HSPS with 70 percent single photon probability (reported in [27]) 
is used, its performance can come close to the ideal single photon case. 

IV. EXPERIMENTAL IMPLEMENTATION 

Our experimental setup is shown in Fig. 3. Using the same structures as in Fig. 1, we can 
get a HSPS with narrow bandwidth (0.8 nm FWHM) and a single photon number probability 
of about 40% (see Table I). (The single photon probability is improved compared with before 
reported in [23]. Because here we use a new pump laser whose coherence length and spectrum 
has a little difference from the former one, which will inevitably influence the following 
focusing and collecting processes. On the other hand, the single photon probability obtained 
has close correlations with the final coincidence counting rate, and the final coincidence 
counting rate is so sensitive to the optical alignment and optical focusing settings. So 
we try to readjust the positions of focusing lenses and re-optimize the optical alignment, 
which result in an increased coincidence counting rate, and also an improved single photon 
probability.) Then the heralded single photons are transmitted from Alice to Bob through 
25 km of spooled SMF-28 fiber (attenuation: 0.2 dB/km), incorporating a one-way Faraday- 
Michelson (F-M) cryptosystem [28]. We use a four-state [29] and one-detector phase-coding 
scheme, which is immune to time-shift attacks [30, 31], faked-state attacks [32], Trojan horse 
attacks [33], and can also been proven to be secure against any other standard individual or 
coherent attacks. 

In order to generate down-converted light with three intensities (//, //, fio), on one hand 
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Fig. 2: (Color online) The key generation ratio vs. the total losses comparing several different 
schemes. The numerical simulations are done in the case of: a) With WCS and without 
decoy-state method, b) With HSPS and without decoy-state method; c). With WCS based 
decoy-state method (with optimal values of \J at each point and an infinite number of decoy 
states), d) With HSPS based decoy-state method with P cor =40% (/z' = 5.325 x 1(T 3 and 
fi = 6.600 x 10~ 4 , these parameters come from our experiment. After numerical simulation, we 
also find the key ratio is stable with moderate variations of the value of // or fj,). e) With HSPS 
based decoy-state method with P cor =70% (// = 5.325 x 10" 3 and fj, = 6.600 x 10~ 4 ). f) With the 
ideal SPS. (Noted: For fair comparison, we consider using infinite number of signal pulses, so we 
don't take statistical fluctuation into account in all these lines above.) 

we place an acousto-optic-modulator (AOM, 3.5 dB loss) in front of the PPLN crystal, on 
the other hand, we use a fiber pig-tailed optical switch (OS, 0.6 dB loss) at the arm of signal 
photons (1555 nm). By controlling both of them in our program (changing between \J and \x 
with AOM, and changing between \x and \i§ with OS), we can randomly generate signals with 
three different mean photon numbers: [//, fj,, /i ] = [5.325 x 10~ 3 , 0.660 x 10~ 3 , 0.577 x 10 -5 ]. 
(Because of an imperfect isolation ratio of the optical switch (~ 20 dB), we don't produce 
a real vacuum state, but generate a low mean photon number for /j, . We use its counting 
rate instead of Y for the estimation of Yi, resulting in a lower estimated value of Y\. This 
also gives a lower key generation rate.) The ratio of heralding pulses {i.e., gating instances) 
between the three intensities is about 10 : 4 : 1. In order to minimize the impact that the 
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Fig. 3: (Color online) The experimental setup of our quantum key transmission system. PPLN: 

periodically-poled LiNbOs; AOM: acousto-optical-modulator; WDM: wavelength-division 
multiplexing; OS: optical switch; TC: time chopper; BS: beam-splitter; FM: Faraday Mirror; PM: 
phase modulator; DL: delay line; QC: quantum channel; SPD: single photon detector; CB: 

control board. 

power change would have on the triggering rate (since when we change the pump intensity, 
we change the intensities of both 809 nm and 1555 nm photons), we inserted a fixed dead 
time after each electrical pulse generated from the Si-APD, calling it time chopper (TC). 
This way, when the power is increased, the triggering rate does not increase in the same 
ratio, and according to experimental verification, the dark count probability of our InGaAs 
APD does not change significantly with the dead time implemented. This dead time was 
implemented in the software controlling the whole QKD session, and it was also important 
for our electronic circuit to be able to keep the transmission synchronized. In addition, in 
order to get a higher visibility in the F-M interferometers (> 95%, without removing any 
dark counts), we use a wavelength-division multiplexing (WDM) filter to further narrow the 
bandwidth of the signal photons to 0.4 nm at FWHM. (The spectra measured before the 
WDM and after the WDM of 1555 nm photons are shown in Fig. 5(a). Fig. 5(b) shows the 
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Fig. 4: (Color online) Comparing the theoretical values and experimental results in coincidence 
counting rate and the final secure key rate. The top line represents the theoretical counting rate 

for signal photons (//); the bottom line represents the theoretical secure key rate (taking 
statistical fluctuation into account). For each line, we investigated two points at the total loss of 
31dB and 36dB individually. The stars and triangles are corresponding experimental results. 

interference curve of our F-M interferometer measured with a "strong" light after the WDM 
filter.) 

In our quantum cryptosystem, in order to compensate for the phase-drift in the inter- 
ferometers caused by the environment, we adopted a scan and transmission mode. The 
electronic circuit first generates an interference curve, to obtain the correct working volt- 
ages for the phase modulators, and then quantum transmission occurs. After a few blocks 
of data are exchanged, transmission is stopped and scanning recommence to verify if the 
working point has changed for the next transmission burst, then this pattern follows. For 
details we refer to [28] . The scan and transmission mode used makes the system quite stable 
for several hours of continuous measurements. For example, during a typical measurement 
of 12000 s, (with effective transmission time about 4200 s, the scan and responding time 
are considerably longer than the transmission time because of the low coincidence count 
rate), with a total of 1.5 xlO 9 triggering pulses, the detection efficiency is about 7.5%, the 
"vacuum state" counting rate is about 0.8 x 10 _5 /gate, (we attribute 0.7 x 10~ 5 coming 
from dark counts, and 0.1 x 10~ 5 coming from the leakage of the optical switch and the 
misalignment of the system,) the counting rate, (Qp) and average QBER, Ey (E^) are 
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Fig. 5(a): (Color online) Spectra of the signal photons (1555nm) with a strong pump, al) 
Measured before the WDM filter; a2) Measured after the WDM filter. 
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Fig. 5(b): (Color online) The interference curve measured with a "strong" light after the WDM 
filter passing through our F-M interferometer. (Without removing any dark counts.) 

about 1.01 x 1(T 4 (1.06 x 10" 4 ) and 6.33% (5.44%) respectively. After a total loss of 36 dB, 
we get a key generation rate of about 5.065 x 10~ 6 . Finally, we obtain 5065 secure key bits 
from a total of 143176 coincidence counts, which agrees well with the theoretical value as 
shown in Fig. 4 (using a similar simulation model as [20, 22] in our theoretical predictions). 
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V. CONCLUSIONS AND PROSPECTS 



Our final key rate is lower than those in other systems reported [34-38], because there 
are substantial losses in our present system. Apart from the insertion loss of the WDM 
filter, the optical switch and a very low detection efficiency of our detector, the main loss 
comes from the F-M interferometer used, because the signal photons have to go through 
each phase modulator (PM) twice, and have to suffer losses from two beam-splitters (BS). 
The aforementioned reasons caused a total loss of about 31 dB. However, using present 
technology, it's realistic to decrease the loss to a lower value. For example, in order to 
remove the loss coming from the WDM filter, a narrow bandwidth filter at the wavelength 
at 809 nm can used at heralding photons instead. This will not only avoid the loss of signal 
photons, but also increase the correlation rate of photon pairs (it's 70% reported in [27]). 
Or if a cavity structure is used during the parametric down-conversion processes, it will 
intrinsically depress the bandwidth of the down-converted light. Moreover, to overcome the 
loss coming from the F-M interferometer, a low loss Mach-Zehnder (M-Z) interferometer 
([38, 39]) can be used instead. Alternatively, if a polarization-coding scheme is used to 
replace present phase-coding scheme, no interferometer needed, so the scheme will suffer 
even less loss. In addition, we can also use a better detector at 1555 nm (with a lower dark 
count probability (~ 10~ 6 ) or a higher detection efficiency (10 — 15%)) or use a two-detector 
scheme. In all, it's quite realistic to reduce loss by 15 — 18 dB with present technology, 
corresponding to an increased transmission distance of more than 100 km. 

In summary, though our present setup still contains many deficiencies, our experimental 
results are sufficient to in principle demonstrate that our using the HSPS based decoy state 
scheme could overcome many practical schemes in loss tolerance, which also means it could 
give a highest key generation rate under fixed loss. Besides, our scheme does not evoke 
higher costs or other technological requirements than in any other schemes. Therefore, even 
when practical usability is taken into account, it is still a very promising candidate in the 
implementation of the quantum cryptography in the near future. (The first three authors-Q. 
Wang, W. Chen and G. Xavier contribute equally to the work.) 
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